refactor(pipeline): specs/plans are gitignored working files, never committed

Per-cycle specs and plans stop being git-tracked commit-then-git-rm
artefacts and become git-ignored working files: created on disk for the
active cycle, read across sessions from the working tree, and shell-rm'd
at cycle close by audit. Nothing is committed, so there is no
git-history copy — the durable record of a cycle's intent is the design
ledger only, and no durable artefact (code, test, doc, ledger) may cite
a spec/plan by number or path.

- conventions/pipeline/design/README: invert the git-tracked -> git-rm
  -> git-history-recovery model to gitignored -> shell-rm -> ledger-only.
- naming: drop the NNNN file counter; files are slug.md (fieldtest specs
  keep a fieldtest- prefix as the cycle-close discriminator).
- cycle number: separated from the (now-gone) file number, sourced from
  the feat(NNNN)/audit(NNNN) commit subjects, which cycle commits carry.
- specify/planner/fieldtest/fieldtester: no commit step; fieldtest splits
  fixtures (committed as code) from its spec (gitignored), with the
  cross-cycle rule that a fieldtest- spec belongs to the next cycle.
- boss: auto-sign auditability moves from the (boss-signed) commit
  subject to the run's reference issue; rollback reverts only code.
- audit: new Step 5 shell-rm's the cycle spec+plan after the architect
  reads them, sparing fieldtest- specs.

Companion machine config (outside this repo): the global git excludes
(~/.config/git/ignore) gains docs/specs/ and docs/plans/ so the ignore
applies to every project at once.

README.md

@@ -111,11 +111,13 @@ This repo (the **plugin**) carries everything that is universal:
 The constants that used to be configurable but were the same in
 every project are now **fixed conventions** — named directly in the
 skills and documented once in `docs/conventions.md`: spec dir
-`docs/specs`, plan dir `docs/plans`, 4-digit per-directory naming,
+`docs/specs`, plan dir `docs/plans`, slug-only `slug.md` naming,
 the vocabulary above, standing reading (`CLAUDE.md` + `git log -10`),
 git discipline, Gitea + `closes #N`, and the whole pipeline graph.
-Specs and plans are ephemeral — git-tracked, held only for the active
-cycle, then `git rm`'d at cycle close; git history keeps the record
+Specs and plans are ephemeral — git-ignored, held only for the active
+cycle, then shell-`rm`'d at cycle close (never committed, so there is
+nothing to `git rm` and no git-history copy); the design ledger is the
+durable record and no durable artefact cites a spec/plan
 (`docs/conventions.md` § Lifecycle).
 
 The handful of facts that genuinely vary per project live in the
@@ -141,7 +143,8 @@ spec boundaries unattended. (Outside `/boss` the user signs every spec
 directly.) The autonomous signature is the **`grounding-check` `PASS`**:
 an independent fresh-context agent's verdict against currently-green
 tests, not the orchestrator's confidence. On `PASS` the orchestrator
-commits the spec (`(boss-signed)` in the subject), sends a mandatory
+keeps the signed spec as a git-ignored working file (never committed) and
+records the sign on the run's reference issue, sends a mandatory
 informational notify that names the signed capability and invites a
 veto, and continues to `planner` without stopping. A no-override
 grounding `BLOCK` / `INFRA_ERROR` routes to the human sign-off pause.